Gatekeeper Approved Apps

Overview

Evidence: Gatekeeper Approved Apps Description: Collect Gatekeeper apps allowed to run Category: System Platform: macos Short Name: gatekapp Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Gatekeeper approved apps list shows binaries allowed to run by Gatekeeper exceptions. This data is essential for understanding application allow-listing and detecting unauthorized approvals.

Data Collected

This collector gathers structured data about gatekeeper approved apps.

Gatekeeper Approved Apps Data

Field	Description	Example
Path	Path	Example value
Requirement	Requirement	Example value
CTime	C Time	123
MTime	M Time	123
LastChangeTime	Last Change Time	2023-10-15 14:30:25+03:00
ModificationTime	Modification Time	2023-10-15 14:30:25+03:00

Collection Method

This collector queries the gatekeeper_approved_apps table via osquery and records results into gatekeeper_apps.

Forensic Value

This evidence is crucial for forensic investigations as it highlights exceptions and approvals that may indicate policy bypass or persistence via whitelisted binaries.